Are you using server validation on the form?
it is easy to pass client side validation. you should have server validation in place.
Also double check that the Server Validation server behavior and the Universal Email server behavior are using the same trigger. If they use different tigers it may be possible to by pass server validation but still trigger universal email. using the same trigger for both will mean that if one is bypassed, both are bypassed.